SAP Security Notes, September 2024

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.

September 2024 notes

Summary and highlights of the month

We have a total of 19 notes for the entire month (the 19 from Patch Tuesday, 16 new ones and 3 updates).

We will review in detail a total of 2 notes, the HotNews and the high note of the month, which are 2 updates (those with a CVSS score greater than or equal to 7).

1. The most critical note of the month (with CVSS 9.8) is a HotNews related to “Missing Authentication check in SAP BusinessObjects Business Intelligence Platform”.
2. The next in terms of criticality (CVSS 7.4) is another high note related to “Information Disclosure Vulnerability in SAP Commerce Cloud”.
3. The following in criticality (CVSS 6.5) are 2 medium notes related to “Multiple vulnerabilities in SAP Replication Server (FOSS)” and “Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)”.
4. This month, the most predominant type is related to “Missing Authorization check in SAP” (6/19 on patch day).

In the chart, we can see the classification of the September notes, as well as the evolution and classification of the past 5 months (only notes from Sec. Tuesday / Patch Day – by SAP):

Full details

The complete detail of the most relevant notes is as follows:

1.  Update – Missing Authentication check in SAP BusinessObjects Business Intelligence Platform (3479478): In SAP BusinessObjects Business Intelligence Platform, if Single Sign-On (SSO) is enabled in enterprise authentication, an unauthorized attacker can obtain a login token through a REST endpoint, which could compromise the entire system. This severely affects confidentiality, integrity and availability. The issue is fixed in the patches for SBOP BI PLATFORM SERVERS 4.3 and 2025 releases. CVSS v3 Base Score: 9,8 / 10 [CVE-2024-41730]
2.  Update – Information Disclosure Vulnerability in SAP Commerce Cloud (3459935): Some OCC API endpoints in SAP Commerce Cloud allow including sensitive personally identifiable information (PII) data such as passwords, emails, mobile numbers… in the URL, which can compromise the confidentiality and integrity of the application. SAP Commerce Cloud addresses the vulnerability by creating new OCC API endpoints, which transmit sensitive data only through the request body. Customers must update their code to use the new secure endpoints. CVSS v3 Base Score 7,4 / 10 [CVE-2024-33003].

Reference links

Other references, from SAP and Onapsis (August):

Digital Library (sap.com)

SAP Patch Day: September 2024 – Onapsis

Resources affected